Bitcoin's race to outrun the quantum computer - <AUTHOR> https://decrypt.co/8498/bitcoins-race-to-outrun-the-quantum-computer <comment><USER2> Just to be clear, this has barely anything to do with any crypto-currency organization. It is a really regrettable framing for an event that should be of great interest to anyone dealing with cryptography, not just the fairly restricted group of crypto-currentcy enthusiasts.

If __scalable __quantum computers can be built (which seems probable, as we are progressing fast in the number of qubits we can keep together), then certain restricted types of public key encryption will be broken by quantum hardware (all currently used public key encryption actually). We know other public key encryption algorithms exist that can run on classical computers and still not be broken by quantum computers. In many ways they are less tested and less practical, so for a while NIST has been sponsoring the development of such quantum-resistant running-on-classical-computers public-key algorithms. The usual name for this is post-quantum encryption.

<comment><USER3> > which seems probable, as we are progressing fast in the number of qubits we > can keep together Probable? Ridiculous:

×there are still no hardware implementation of a single logic gate despite what? 40 years of research? ×stability of qubits are pathetic. ×no software stack (almost) ×Number of qubits are ridiculous and 40 years of research can't even make a consensus on how much qubits are needed for beating a CPU on at least _one_ task. Even if quantum _could_ (I strongly doubt that and quantum speedup has never been shown empirically) reduce complexity on some algorithms, the constant factor has no way to be handled with 50qbits, more like 1000000 qbits at minimum. ×no sign of needed breakthrough in error correcting codes.

I consider quantum speedup to be theoretically flawed, based on an interpretation of quantum mechanics needing "parallel worlds" which necessitate a misunderstanding of causality to make sense.

I consider quantum speedup to be flawed in practice too as order of magnitude of order of magnitude progress is needed and the trend is: no progress or very slow progress.

Thus quantum computing is like a vaporware, which take funds that would be far better allocated at e.g medicine, AGI, or ASICS.

<comment> semi-extrinsic While I agree that QC is far from cracking any encryption today or in the near future; this

> theoretically flawed, based on an interpretation of quantum mechanics > needing "parallel worlds"

is patently false. There is nothing in QC that would stop working under the good ole' Copenhagen interpretation.

In fact, if there was even a theoretical possibility that a QC experiment would work only in some QM interpretations, they would no longer be interpretations, but falsifiable hypotheses.

<comment><USER4> Copenhagen postulates collapse, no? If collapses turn out to happen at problematic times or because of problematic conditions, it could potentially doom quantum computers.

In contrast, many worlds says basically: There is no collapse. Ever.

The fact that no one has found what triggers collapse yet is to me evidence that Copenhagen is false.

Pilot wave theory on the other hand is, afaiu completely equivalent to many worlds, but less philosophically convincing.

Where many worlds says there is only the wave function, pilot wave says there is a wave function but also the material world. And material world is a sort of "view" of the wave function. Continuously rederived from it. But the interesting thing is, this material world has no causal consequences. All causality stems from the wave function and its evolution. This is the compromise to get same predictions as many worlds.

<comment><USER2> Various interpretation postulate collapses under specific conditions, while other formalisms postulate something mathematically/observationally equivalent at mathematically/observationally equivalent conditions. In particular "problematic collapses" are a thing all quantum computing researchers have to deal with in their work. It is one of the largest subfields of this research program actually (practical quantum error correction).

</comment></comment></comment></comment></comment><comment><USER5> > Take the Bitcoin blockchain: an unencrypted public key is sent along with > every bitcoin transaction, and left unencrypted during the time it takes for > the network to confirm the block, around ten minutes.

My understanding is that it remains unencrypted forever. That's why it is a public key. As long as the coins are not moved to another account that public key stays a valuable target.

Edit: As DennisP pointed out my understanding was wrong and indeed only the hash of the target is published until you make an transaction from an account.

<comment><USER6> So then if Satoshi destroyed the private keys instead holding on to them just in case for an event like this, it's possible that someone might take the million or so BTC just sitting around?

Depending on how easy it is, all those addresses that were abandoned containing 50 BTC are also up for grabs.

Would a coin without public addresses be better suited against such future?

<comment><USER7> Not if Satoshi's coins have never moved. A bitcoin address is a hash of a public key. The public key isn't revealed until the first time funds are transferred out of that address.

<comment><USER8> Nitpick: What you're calling "Satoshi's coins" were actually mined in transactions to pubkeys rather than to pubkey hashes.

Early Bitcoin transactions did not use addresses.

Example from block 1:

[https://www.blockchain.com/btc/tx/0e3e2357e806b6cdb1f70b54c3...](https://www.blockchain.com/btc/tx/0e3e2357e806b6cdb1f70b54c3a3a17b6714ee1f0e68bebb44a74b1efd512098)

You'll see at the bottom that the opcode is a PUSH / CHECKSIG rather than the later DUP / HASH160 / PUSH / EQUALVERIFY / CHECKSIG format.

So this isn't true. (blockchain.info derives an address but actually the pubkeys are right there in plain sight. Have at it!)

<comment><USER7> Thanks, I had no idea!

</comment></comment></comment></comment></comment><comment><USER9> It's worth mentioning that Bitcoin addresses aren't exposed on the blockchain as public keys, but hashes of the public keys. If you want to steal the coins you'll need to turn ripemd160(sha256(sha256(publicKey))) into a private key. Good luck.

<comment><USER7> Yes, but the public key is exposed when you send from that address. If a quantum computer is quick enough, it could get your private key and issue its own transaction, racing you to get into a block.

<comment><USER10> Cracking a public key in 10 minutes is much harder than cracking a public key (at all). Considering we haven't cracked anything yet, I wouldn't be worried about that. Also, if you're transferring thousands of bitcoin and want to be safe, you could always privately send it to a miner rather than broadcasting it. In that case the tx would have 1 confirmation before the the public knows about it, requiring them to also pull off a 50% attack.

<comment><USER7> A QC factors the current public key algorithms in constant time. More qubits just means you can factor bigger keys. How big that constant is will depend on how the QC works.

Sending privately to a miner would help, but you'd end up with a very centralized system since you would want to send to the biggest miner, to minimize the time until that miner produces a block. You can't have miners sharing the transaction, even privately among themselves, since if they did that then one of them could have a QC and you wouldn't have any way to know who stole your money.

</comment></comment></comment></comment><comment><USER11> Problem includes far more than bitcoin.. Your bank for example

<comment><USER12> Not really. Your bank (and the whole web) can easily switch to a quantum resistant encryption algo when time comes.

For Bitcoin this is much harder.

<comment><USER13> Its not much harder for bitcoin...

The community will just do a blockchain snapshot of balances at an agreed upon block and start a new distributed ledger with quantum resistant encryption

Snapshots have been done hundreds of times

<comment><USER12> Everybody will need new private keys.

What do you do with old coins? Satoshi's one for example? Or lost coins that nobody has the key for?

Do you set a threshold day, after which all unclaimed coins are just marked destroyed forever? If not, how do you know someone claiming some coins didn't use a quantum computer to get the key?

<comment><USER10> >Do you set a threshold day

yeah pretty much.

>What do you do with old coins? Satoshi's one for example? Or lost coins that nobody has the key for?

If those coins hasn't been touched for decades, despite widespread announcements of pre-quantum cryptography (presumably it wouldn't happen overnight), it's safe to say that nobody is going to claim them.

<comment><USER13> Dont treat any address differently

</comment></comment></comment></comment></comment></comment><comment><USER14> _> Ah, but with the right quantum computer, able to process information at speeds exponentially faster than today's supercomputers? Suddenly, what seems uncrackable becomes child's play, able to be broken in under 10 minutes._

Cringe. Quantum computers are not "able to process information at speeds exponentially faster than today's supercomputers". They're able to solve a very specific subset of problems which are hard for classical computers. A very specific subset, called BQP, mostly having to do with finding prime factors. NP hard problems are probably uncrackable with quantum computers.

</comment><comment><USER15> I get that quantum computer can run faster with more states. But can someone with quantum computing experience explain how quantum computer can address exponential computation? Does it reduce exponential computation into polynomial?

My answer to the above question is no. Assuming a quantum computer has 10 states. Its running time for exponential algorithms is still exponential. A simple example: 2^10 is about 10^3. Still exponential.

</comment><comment><USER16> Will breaking classic computer public key encryption reveal any secrets that were encoded prior to them being obsolete?

Should we be recording encrypted streams and saving them for a few years until we can break them? Is there any value in that?

<comment><USER17> What do you think the NSA is doing?

The public blockchains make all this more feasible since they have the community keep the data around in original state for them!

So much cheaper than recording SSL/TLS traffic, for example.

Also that is why they would find it important to exfiltrate the data from a company (or government) before it can be re-encrypted with something better.

</comment></comment><comment><USER18> What a deceptive article.

They take a crypto conference happening at a prestigious institution and sprinkle in some bitcoin punditry to make them seem related.

</comment><comment><USER19> "The amount of time the universe itself has left—around 0.65 billion billion years."

Is this true?? I've never heard this claimed before.

<comment><USER20> I've never seen it framed that way, but they may be referencing the estimated timeframe for the "heat death" of the universe:

[https://en.m.wikipedia.org/wiki/Heat_death_of_the_universe](https://en.m.wikipedia.org/wiki/Heat_death_of_the_universe)

<comment><USER19> Yeah that was my assumption but I've never seen that specific time frame proposed and it just seems like the kind of thing I would have heard of if it was a know fact.

</comment></comment></comment><comment><USER21> This is a general problem with public keys, not just Bitcoin!!

One of the problems with current PKI is weakness in the face of quantum computers, leading to a new crop of algorithms being submitted to NIST, etc.

I wanted to ask whether the following simple scheme, based just on cryptographic hashes, can be used CONFIDENTLY, SECURELY and RELIABLY in many situations where Assymetric Key cryptography is used today, and in many others too, such as providing provably random polling etc. It is very similar to a One Time Pad but uses a cryptographic hash function to generate the OTP codes.

Here is the scheme: Everyone generates a random private key K[p] and store it just like any assymetric private key (encrypted with some non-stored derived key).

They use any cryptographic hash function that hasn't had a serious preimage attack (perhaps even MD5?), hash it n (eg 10,000,000) times to get h[p][n], and publicly commit to that number. This is like a public key.

The hashes are long enough that it's infeasible to reverse them. Key strengthening can be achieved by jumping a few onion layers between transactions.

If you start running out then you post a new public key, signed with one of your remaining onion layer codes. Any verifiers store the original public key per participant, and then can replace them with the new public key if it was properly signed by the old one, etc.

Use case: generating provably random numbers by mutually distrusting parties

Participants they gradually reveal their hashes, one onion layer per transaction. Each provably random seed is a function of the alphabetically smallest/largest three of those hashes at the next onion layer. If not all of them reveal the hashes in time, they gossip, verify and agree on which ones are the smallest/largest three before some cutoff point like "most reported that most reported". That leaves tons of bits of entropy coming from everyone!

Use case: Authenticator Apps

The hash h[p][n+1] would be a hash of some substring of h[p][n] with enough bits that finding all chosen preimages (by an eavesdropper of the previous code) would be infeasible in advance. Perhaps 10 alphanumeric characters is enough. Also when displaying the code to enter, the authenticator app can tell the user a number from 1-100 indicating to the verifier how many onion layers to peel, making it harder to precompute the preimages. Or the user would have to enter the entire hash via the network-connected computer scanning a QR code, NFC or something. From a security standpoint, this method seems superior to the HOTP and TOTP schemes used in authenticator apps today, since there is no need to trust the verifier with any secret keys ([https://www.ietf.org/rfc/rfc4226.txt](https://www.ietf.org/rfc/rfc4226.txt)) Also there is no need to sychronize clocks, since the client simply lets the server know how many times to run the hash, and increments that number every time.

Use case: Signing Payloads

Participants reveal a payload and commit to an HMAC signature by using cryptographic key at the next onion level, which at that point would be known only to them. All these signatures are collected into a blockchain block / merkle tree timestamp / similar thing, and it is sent to the participant before they reveal the onion key they used to sign it.

Use case: Off the Record Messaging

The Blockchain or Merkle tree is private between a few parties only, so once the next onion level is revealed, no participant can prove the payload was generated by a given participant, since all the onion hashes were known, any of them could generate a new valid tree with any payload history. They can only prove it to each other, or given enough "witnesses" attest to that tree, people might trust then on the basis of consensus of (presumably) mutually distrusting parties, but that's not the same thing as cryptographic proof. But that is true of any OTR conversation.

Use case: Restoring Access

This can be used instead of Shamir Secret Key sharing. The server would have to store keys for every participant, and M of N participants would just sign that they approve authorization of some new session, some new key, or whatever. These signatures could be easily checked by anyone who has the public keys of the M participants who signed it.

Use case: Decrypting payloads

Not sure how one would do this one, to be honest. With PKI, someone could encrypt a payload that can only be decrypted by a private key holder. I see how to do signatures and HMAC, but not the other way.

</comment><comment><USER22> Finally a good use-case for bitcoin: a bounty for the first quantum computer to crack it.

<comment><USER23> Not really. BTC has no value other than its ability to be exchanged for USD. If BTC is cracked no one will trade their USD for it anymore and it will be worthless.

<comment><USER13> The first person to assume custody of a large amount of bitcoin will sell and be incredibly rich

They can siphon off a lot before other people catch on to people's complaints and realize the best practices were followed

</comment></comment></comment><comment><USER24> Whilst Quantum computing is an interesting topic, gotta say I think bitcoin's challenges are far more mundane and pressing that that.

No.1 challenge is how to stop centralized exchanges from extensive market manipulation.

Decentralized crypto currencies are never going to achieve their goals, whilst players like Bitfinex and Tether are in a position to "print" unlimited amounts of money and use them to purchase coins like BTC.</comment>


LLVM backend for DCPU-16 - <AUTHOR> https://github.com/krasin/llvm-dcpu16/

<comment><USER2> Just a suggestion: there's a lot of cool stuff going on with this project, and it would be a shame if interested people missed out on it. At the same time, posting every cool thing to HN could flood the front page for months :) So let's move discussion of new implementations, assemblers, and disassemlers (at least) to the DCPU subreddit? <http://www.reddit.com/r/dcpu16>

<comment><USER3> Thanks. I didn't know there was a subreddit for this.

Oh dear. DCPU emulation on DCPU? [http://www.reddit.com/r/dcpu16/comments/rz6fd/dcpu_emulation...](http://www.reddit.com/r/dcpu16/comments/rz6fd/dcpu_emulation_on_dcpu/)

</comment></comment><comment><USER4> I'm also working on a compiler targeting the DCPU-16. It doesn't compile C code, instead there's a simple C-like language supporting modules and pointers.

It's not really finished and can surely produce better code, but I wanted to share it anyway.

Here's the fib example from the LLVM backend's README: <https://gist.github.com/2336867>. My compiler currently manages to compile fib to 30 instructions (0x2E words) compared to 38 instructions (0x41 words) for the LLVM backend.

Here's the source: <https://github.com/zr40/dcc>

</comment><comment><USER5> Too bad it doesn't follow the calling conventions proposed on #0x12-dev: [https://github.com/0x10cStandardsCommittee/0x10c-Standards/b...](https://github.com/0x10cStandardsCommittee/0x10c-Standards/blob/master/ABI/Draft_ABI_1.txt)

<comment><USER6> (dcpu16 llvm backend developer here)

That ABI is hard to implement in LLVM, mostly because of SP can't be addressed as [4+SP] in DCPU-16. So, DCPU16 LLVM backend uses C register as a frame pointer (to store local variables and other data) and SP as a stack pointer to store ret addresses.

There're other "flaws" in that ABI which increase the cost of developing an LLVM backend.

I am going to make the supported ABI closer to #0x12-dev ABI in v0.0.5 and report them the most annoying features of their ABI.

<comment><USER7> Great work :) I just spotted something in the compiled example and wonder if this:

        SET  J, [4+C] ; The Notch order
        ADD  J, 1 ; The Notch order
        SET  [4+C], J ; The Notch order

Is not transformed to

        ADD  [4+C], 1

due to some assumptions in llvm, or do you not handle the literal values as arguments yet?

<comment><USER6> It's just because the focus is now on generating valid assembly (there're tons of bugs so far) and I have not paid any attention to optimization yet.

Thanks for reporting, tracked by issue <https://github.com/krasin/llvm- dcpu16/issues/67>

</comment></comment></comment></comment><comment><USER8> Excuse the ignorance, but what is the big deal about DCPU-16?

<comment><USER9> It's a toy CPU that's perfect for learning. It's about to be part of Notch's new game (he created Minecraft). So it's a great combination of fun + educational. Honestly, I'm surprised no one has made one of these CPUs in Minecraft yet. I can guarantee that it's possible.

In other words, this has a lot of people excited about a game that doesn't even exist yet. Oh, and given the popularity of Notch's games and the buzz for this one, I'm sure that a few people will manage to turn a tidy profit based on their fun. There are more than a few highly popular Minecraft websites, YouTube channels, etc. So there are a lot of things that appeal to hackers. It's a great toy system to play with, it's going to be an important part of an interesting game, etc.

Note that some people have already learned about electronics by building redstone circuits in Minecraft. It abstracts away everything but the logic, so it's a fun way to play with logic gates and whatnot to build something interesting. For example, I have a giant circuit hooked to a redstone clock to periodically flood the spawning pads of the gigantic mob grinder that covers my base camp and increase the number of items I get. It's enormous, but not particularly exceptional by Minecraft standards. It does help me produce a lot of TNT, though. I put a record player in the item collection room to pass the time.

<comment><USER10> Post a video please :-)

<comment><USER9> I'll do you one better and give you the whole world:

<http://www.mediafire.com/?6ywsyy18qhening>

Note that it's in the new format. I deleted the parts in the old format to make it smaller. The mob grinder is the huge thing in the sky. The items fall into a room in the upper level of the house.

<comment><USER10> Awesome! Can't wait to give it a go :)

<comment><USER9> Let me know what you think :) There's a lot of stuff in there and you may see that I'm a bit OCD about labeling things. I doubt most people have a sign marking the bedroom. But everything else in the house has a sign, so...

If you're wondering, that railway leads to the dungeon with the end portal. The dragon is dead and his egg warped into the end portal back before I could collect it. Sorry about that. I'm not quite clear on whether I could just delete the region files for the end and make it all respawn, but I might want to try that some time.

There's also a fairly complete map of the area centered on the house in a chest upstairs at the end of the hall. And there are a few random outposts in dungeons. If you ever get lost, there should be lots of markers pointing the way home.

<comment><USER10> FYI There is a bukkit plugin that allows you to duel the dragon as many times as you want.

<comment><USER9> Interesting. Might have to look that up sometime. Hope you've enjoyed my world, even though I know it doesn't hold a candle to some of the fancy creations out there.

But hey, I do have a collection of every single color of sheep, neatly sorted into pens :)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Next up: compile a JVM and run the game within the game???

Joking aside, what are some scripting languages with tiny interpreters that could feasibly compile eventually?

<comment><USER12> Forth, Lisp and BASIC immediately come to mind, and are period appropriate.

<comment><USER13> Turbo Pascal and C would also be quite cool, as they were heavily used in the 16bit days.

</comment></comment></comment><comment><USER14> "Binary distribution for Linux x64 is available. (v0.0.2, 170MB)"

170MB to emulate and compile targeting a 128kb virtual machine. Funny how things have bloated.

<comment><USER15> It's a reasonable price for the convenient abstraction. What's interesting is the size of the binaries and the compression ratio of the whole thing (0.2):

        zoul@naima:llvm-dcpu16 $ du -sh *
         286M	bin
          13M	include
         522M	lib
          76K	share

What's in the binaries so that they are so huge and compress so well?

<comment><USER7> I'm tempted to point at various graph fragments and other cpu descriptions which are partly auto-generated. It's a guess though, I'd like to know a real answer too. Is is a high price to pay for a framework which allows people to port compilers to a whole new architecture in a matter of days?

Also this binary may actually include all targets, not just dcpu16.

</comment></comment></comment><comment><USER16> This is so incredibly cool! But how did you implement I/O?

<comment><USER17> Certain memory areas correspond to the console. If you have a look at Notch's Hello World example you see him putting letters in memory areas.

Now if this is how it will communicate with the rest of the ship, I don't know.

<comment><USER18> A few days ago he was thinking of a message queue... not sure how it would work though.

<http://twitter.com/#!/notch/status/187448370107912192>

<comment><USER7> Since he wants to simulate the cpus all the time and there's no sleep / wait which actually stops execution, tight wait loops shouldn't be an issue. Just wait for some mmaped [msg_no_ptr] to be >0.

</comment></comment></comment></comment><comment><USER19> This is so cool! Just finished my implementation and it runs the fib example flawlessly†!

<https://github.com/tkahn6/dcpu16-haskell/>

† Because mine is a pure state machine and Haskell is lazy, I had to introduce a HLT instruction instead of using `:crash SET PC, crash`. Nothing ever gets printed using the latter convention.

<comment><USER20> You can use a monad to thread the computation for strictness while retaining purity.</comment></comment>


New $100 advanced USB attack platform from Hak5: BashBunny - <AUTHOR> http://wiki.bashbunny.com/ <comment><USER2> I would like my browser to detect websites that break the "Back" button. I hate that.</comment>


Convert SVG path string to point shape and draw with Processing - <AUTHOR> http://processingjs.nihongoresources.com/svgparser/ <comment><USER2> For those who know my Primer on Bezier Curves ([https://pomax.github.io/bezierinfo](https://pomax.github.io/bezierinfo)): this was one of several code explorations I wrote while working on font parsing and generation in 2010, and directly lead to me starting work on writing that primer. Seeing it suddenly pop up on HackerNews is... special.

It's amazing knowing that even silly exploratories from 2010, when the web was so different, still manage to get people excited today.

<comment><USER2> (so, thank you @bryanrasmussen, I never thought I'd see this here)

</comment></comment><comment><USER3> Seems like Firefox doesn't like something about that SVG

> XML Parsing Error: unclosed token

The tags themselves look fine so I think it might be complaining about something missing in the actual path string?

<comment><USER4> It seems to have two bogus characters (U+0085) in its XML. One in the <title>-tag right after _data:_. These are breaking the UTF-8 encoding.

<comment><USER2> fixed.

</comment></comment></comment><comment><USER5> Something is odd about this example. The relative SVG path he gives as an example is missing two segments in the B.

[https://codepen.io/simonsarris/pen/ORwoLA?editors=1010](https://codepen.io/simonsarris/pen/ORwoLA?editors=1010)

<comment><USER2> You just spotted an eight year old contextual feature. While the parser will leave a path "open", only signalling an explicit "close" when it sees `z` or `Z`, it still signals the start of a new path when it sees an `m` or `M` somewhere mid-path. And that's why you're seeing closed shapes even though there don't appear to be any in the original SVG:

There is no such thing as an "open path" in glyph outlines used in fonts (which was the context of this exploratory), so whenever the parser signals a "new path" signal, even when not preceded by a "close path" signal, that's automatically a closed path and the receiver code I wrote treats it as such.

(The starting SVG string was a straight graphics instruction dump from a OpenType-CFF glyph charstring, although I can't for the life of me remember which typeface it came from... it's been a while)</comment></comment>


Photographer detained by police, BP employee after taking picture on public road - <AUTHOR> http://fieldnotes.msnbc.msn.com/_news/2010/07/04/4611161-photographer-detained-by-police-bp-employee-near-refinery

<comment><USER2> Original less incendiary title:

" _Photographer detained by police, BP employee near refinery_ "</comment>


Studies: Premarital Sex, Cohabitation, and Divorce - <AUTHOR> https://www.focusonthefamily.com/about/focus-findings/marriage/premarital-sex-and-divorce <comment><USER2> This is research that people do not want to hear, but is quite interesting.

If you develop a habit pattern, and then want to change your life and follow a new habit pattern, you're going to be less successful at achieving that 2nd habit pattern.

If you want to live a healthy life, giving smoking a go is not a good start to that, and will make achieving healthy living much harder.

So, it's not really a surprise that engaging in non-monogamous behavior would set someone up for failure in marriage.

<comment><USER3> Uhm... How and why did you go from premarital sex to non-monogamous behavior?

<comment><USER4> There are very few people who don't believe the claims in the linked article who have never engaged in non-monogamous behavior (this is not a euphemism for cheating, it is a category that includes it).

</comment></comment></comment><comment><USER5> Could have swore I saw this on the front page for just a moment, but it's gone now. Did it get downvoted into oblivion or is there some other reason this was on the front page with under ten points?

<comment><USER6> Users flagged it. When enough users do that relative to upvotes, the submission falls in rank.

<comment><USER4> [http://www.paulgraham.com/say.html](http://www.paulgraham.com/say.html)

<comment><USER6> Paul Graham developed this flagging system.

<comment><USER4> I understand; I don't mean to criticize the flagging system or moderation team. I just wanted to nod at the fact that we can't talk about this.

<comment><USER6> It's ok to talk about it! we answer questions about things like flagging all the time.

<comment><USER4> I mean the content of the flagged submission, which is morally unfashionable.

<comment><USER6> Ah, now I get you. Took me a while.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Sincere question: when will 'marriage' become unfashionable? It has outlived its usefulness. We can test paternity..women are financially independent and shared dna can claim shared costs. You can store genetic material.

There is literally no reason for marriage ..an archaic social institution..to exist.

I can only see two (arguably questionable) purposes for legal union, health insurance(in America) and filing taxes jointly.

ETA: Ok. One more. Immigration.

Change my mind.

<comment><USER8> Only reason you need: It exists in most places and is so ubiquitous that you will probably never get rid of the concept of marriage no matter how hard you try, so you might as well live with it and work around it. Maybe it's useless to you, but a lot of people like to do it. It's like asking why some cultures still eat really unhealthy(but hella delicious) stuff when they have access to organic cow-fed vegetables. Because it's their culture they always had, and it's just really delicious.

<comment><USER7> That sounds defeatist. We don't have to accept anything we don't reasonate with..I would like to believe that we have at least come that far..

I agree that people can do whatever they want but like I said earlier, it restricts people. I beckon the same examples...immigration, taxation, insurance etc.

Why can't I include my elderly neighbour in my health insurance? If my parents visit me and they are not citizens, I have to purchase a tourist health policy for them and they are family..why should only my spouse and children be considered family.

If I have a partner I love and would like to travel to another country to live for a few years, I can't do it unless they are a spouse. Etc.

I don't want to touch taxation. But you get the idea.

We reward legal and religious marriages while unions and friendships or other relationships are not equitable. Why?

<comment><USER4> The state subsidizes marriage primarily for the purpose of subsidizing child- rearing. This has been obfuscated in recent times, but there is little other reason for these subsidies to exist and your confusion is warranted.

</comment></comment></comment></comment><comment><USER9> Lol,

reducing risk of divorce != increasing happiness

<comment><USER4> You're joking, but this is true at the individual level because you can marry the wrong person. At the population level, reducing divorce does increase happiness and is something we should design for.

<comment><USER9> Not at the cost of forcing people to stay with the wrong partner.

What's the likelihood of a person who is unlikely to engage in premarital sex to stay with a bad partner? Seems like set has large overlap because religion would be a common factor for both.

<comment><USER4> I agree. The idea is we all be extremely selective about who we choose to give ourselves to.

Your comment raises the question, what is a bad partner? How do incompatible relationships arise? I'd say most often the dominating force behind bad relationships is strong physical attraction. To give a personal example, I married a very beautiful woman who turned out to be immensely destructive to myself and everyone I loved, including her and her family. She had a serious personality disorder. I was immediately blinded by how attractive she was, how good the sex was, and how intimately we engaged with each other in general (though often this had dark sources like codependency and fear of abandonment). There were warning signs I could have chosen to pay attention to, but I thought at the time this is an incredible woman I've met and if things don't work out, that's O.K., there's nothing to lose.

But I lost a lot. I fell in love deeply enough to tolerate all sorts of madness and it ended tragically. I won't even allude to the details here.

If I really forced myself in the beginning to think about whether I could in fact devote my life to this woman and our future family (which is the calling of sacramental marriage) before choosing to date her, my life would be unrecognizably different and certainly contain less tragedy.

Sex allows unstable relationships to develop into failed serious relationships. Failed relationships harden the heart, reducing one's ability to love, trust, and enjoy other people. It's terrible but it's true, and anybody who's had at least one bad relationship will tell you. If you're lucky you can mostly recover but the damage is still done and it shows in the numbers.

<comment><USER10> I agree with everything this person just said.

</comment></comment></comment></comment></comment><comment><USER11> Why did you post this here?

<comment><AUTHOR> I thought HN community was a data/evidence driven community no matter the POV. I am afraid I am mistaken for the 2nd time, liberal thinking is the norm, so something diff just gets flagged... sigh

<comment><USER4> This is a specific brand of left-wing liberalism causing the trouble. I've always called myself a liberal and I'm tremendously disappointed that James Damore got fired from Google and basic survey articles get flagged off HN for involving "dangerous facts". It's hard to be a straightforward and honest person in these conditions, and it only encourages people to retreat into insular and subversive communities. Those complicit with left-wing censorship have an incomplete appreciation for the dangers of building a community that doesn't care about truth before hurting people's feelings or fumbling negative-sum political games they've accidentally participated in.

</comment></comment></comment><comment> dfeojm-zlib Thanks for flagging this Christian conservative propaganda.

<comment><USER4> This may be Christian propaganda, but if it is propaganda it is such in the classical sense: a truthful presentation designed to influence your thoughts and behavior toward a particular worthwhile end. It resides in the same spiritual realm as Plato and Epictetus.

God bless,

1000units</comment></comment>


Why In The World Should Instagram Allow Twitter To Scrape Its Photos? - <AUTHOR> http://www.businessinsider.com/why-in-the-world-should-instagram-allow-twitter-to-scrape-its-photos-2012-12

<comment><AUTHOR> I really, really hope this guy is joking, and doesn't seriously believe that "the internet's" revenue model should go the way of old media...

</comment><comment><USER2> Can't decide if I'm being trolled....

Instagram slapping a filter on my image and hosting it isn't equal to a WSJ writer penning an article, or ESPN producing a broadcast.</comment>


Galaxy Note 8 and Dex – one month later: I almost ditched my PC - <AUTHOR> https://www.slashgear.com/galaxy-note-8-and-dex-one-month-later-i-almost-ditched-my-pc-27505741/ <comment><USER2> I think this is the reason Microsoft can wait a few years before attacking the mobile phone market again. The new mobile phones will support an average desktop user experience. Not saying that Microsoft will execute this well but the Surface was a success.</comment>


Who Doesn't Want Their Own Personal Flying Watercraft? - <AUTHOR> http://www.futureofgadgets.com/futureblogger/show/1337-who-doesn-t-want-their-own-personal-flying-watercraft-

<comment><USER2> As someone who is currently getting his pilot's license, I wouldn't be comfortable sitting in a craft that abstracts flying to making "it seem like more of a car that is able to move in three dimensions." Regular pilots are well-versed in everything from weather, to emergency conditions, to physics of flight and practicing everything that can possibly go wrong. Not to mention interacting with other aircrafts. I really hope that they took this into account. It's very improbable that they didn't.

I am just scared that many drivers' feelings of entitlement being transferred to something that flies. People forget that a car is capable of injury and death and end up taking liberties behind the wheel. Then again, it might be psychologically different when you're actually flying.

I'm all for opening up aviation to a wider audience, but something doesn't smell right.

edit: Looks like they require a sport pilot license. I'm less worried now :)

<comment><USER3> You don't need to worry too much...unless they manage to get it under 254 pounds and qualify it as an ultralight, the FAA will still be the last word on the requirements to fly it.

<comment><USER4> Sport pilots are allowed to fly Light Sport planes. Light Sport planes can weigh up to 1320 lbs. If you are interested in flying read some of Phillip Greenspun's stuff.

<http://en.wikipedia.org/wiki/Light-sport_aircraft> [http://en.wikipedia.org/wiki/Pilot_certification_in_the_Unit...](http://en.wikipedia.org/wiki/Pilot_certification_in_the_United_States#Sport_pilot)

<comment><USER3> Sport pilots and Light sport planes still fall under FAA rules and still require fairly extensive flight training and certification.

</comment></comment></comment></comment><comment><USER3> This airplane looks like it will be awesome. However, as someone who has grown up around aviation and is always looking at what's available and the new companies that are launching, this seems like another vaporware project. A big warning sign to me is the amount of press and publicity they're going after, but almost all their promotional images are CG mockups. If they're planning on mass-producing this thing in 2010, they should have flying models right now. Not saying it'll never happen, but don't be surprised if the price point and delivery date both change. I hope I'm wrong.

<comment><USER5> hello? there is a video with a prototype flying?

</comment></comment><comment><USER6> 300 preorders? Not bad for a new expensive product/technology.

<comment><USER7> its not that expensive compared to other planes. + people always want to be the first to have the latest gadget</comment></comment>


NSA worried quantum computing will foil the cryptography protecting all data - <AUTHOR> http://www.ibtimes.co.uk/nsa-worried-that-quantum-computing-will-foil-cryptography-protecting-all-data-date-1516795 <comment><USER2> I know the NSA has been involved in developing crypto for years but I still find it highly ironic that they are now concerned about damaging cryptographic technology after their last few years tampering with various standards and such to gain advantage in breaking them.</comment>


You and your job - <AUTHOR> http://youtheuser.com/2010/10/04/you-and-your-job/ <comment><USER3> I believe he missed a few situations:

* If it is Tuesday - leave. * If your house is yellow - leave. * If someone sneezed in your building - leave.

The resume you build would be a nightmare for any employer. Once you become completely competent in your job or become a key player, promptly resigning seems like the worst possible thing.

Could you imagine the next HR interview?

HR: "Why did you leave you last job?" A: "I learned everything about the product, was completely productive, and enjoyed the work. So, I had to leave."

Also, stringing off to create your own product would be even worse advice. The moment your complete the first rendition of a project, you would meet all the requirements to quit working on it. Your manager, yourself, would want you to stay, which means you would violate the "If your manager wants you to stay - leave." rule.

<comment><USER4> My experience has been that once you're completely competent in your job, that's the job your stuck with. You can try to grow into other areas (and end up doing 3 people's jobs) or apply for different positions but you're out of luck since you've become a 'key employee.' Whether that's bad management or my inability to play office politics, it's happened more than once.

Which made it time to leave.

<comment><USER5> I've generally found that once an employee is completely competent (or exceptional) at their job, they are promoted to manager where they are miserable or ineffective. It's called "the Peter Principle," and it is disturbingly common in the technology world.

<http://en.wikipedia.org/wiki/Peter_Principle>

<comment><AUTHOR> As an employee you don't have to accept those promotions. You can push to expand your role in engineering instead.

<comment><USER6> Provided your company is far-sighted enough to pay you according to your ability, not your managerial rank. For most the money is too good to turn down.

<comment><AUTHOR> The one time I've been in that situation I've ended up leaving that company and taking a much better paid engineering role at a different one :)

</comment></comment></comment></comment></comment></comment><comment><USER7> As weird as this post was, it was still only half a post. Lots of interesting thoughts, but the most important questions were never addressed:

      1.  Where do you go?
      2.  How do you find it?
      3.  How do avoid being in the same position a year later?

OP's advice is a recipe for a bad resume and a more miserable employee. Sometimes you just gotta put up with a little shit for a while before the right path becomes available to you. Ironically, the times when OP advises you to leave can be your opportunities of greatest growth when you don't even realize it.

<comment><USER8> OP has a point. In my previous job, when I looked around, it seemed like almost everyone seemed be to just coming to the job to get paid. In some pathetic cases, after seeing some really unhappy people dragging it for over a year, I have screamed silently - why don't they go find something else ?

This post makes a point, but its not to be taken literally.

<comment><USER9> >> why don't they go find something else?

\- Because the opportunity hasn't presented itself.

\- Because s/he can't afford to quit a job when her/his spouse has just been laid-off.

\- Because the car/house/dental treatment hasn't been paid-off.

\- Because those students loans can not be deferred

\- Because this company actually pays for the a good part of tuition, and requires that the employee stays for at least a couple of years after graduating.

\- Because the person has already left four or five different jobs previously, so it's getting harder and harder to justify to an interviewer why the company should hire someone that can't stay at the same place for more than 18 months

</comment></comment></comment><comment><USER10> I like the sentiment, but a little bit over the top. According to this, there really isn't a single situation in which you should stay at your current job.

"If your manager is trying to make you stay, they aren't a good manager – leave."

If you're doing a good job, I'd say your manager is not doing his/her job if he/she is not trying to make you stay.

<comment><USER11> Agreed, the manager is working for the company, not for the employee, so keeping a good employee is in the best interest of the company, even if it's not optimal for the employee.

</comment></comment><comment><USER12> What a brain-damaged article. Seriously, what's next?!

"If you have a good life, commit suicide. If you have a great wife, leave her. If you have kids, leave them and never return. If your company starts making a profit, sell it at a loss. If you're healthy, recklessly endanger yourself. If people like you, start acting like an asshole. If you have a nice social network, cut off all ties. If you're rich, waste it all and then go live in the street. If you like this article, write me a scathing piece of hate mail."

</comment><comment><USER13> This post obviously assumes one can simply _afford_ to leave a secure position for an insecure one.

What about the wife, kids, mortgage, and bills?

Clearly not very practical advice.

<comment><USER14> There is a big difference between

1) impractical

2) does not apply to all life situations

<comment><USER13> You're right. I should also have been more neutral/PC:

What about the _spouse_ , kids, mortage and bills?

Clearly not practical advice _for people with commitments_.

Funny that reading the post, the younger me would've agreed without question.

</comment></comment></comment><comment><USER15> Programmers -should- feel slightly challenged. If we don't, we tend to make things more complicated until we do.

One of the solutions I've found for that is to try to make the solution as simple and clean as possible. That adds the 'complexity' in the right direction, instead of the wrong one. It's still difficult to do, but not because the code is an untamable hydra.

Researching new tools, like Unit Testing, has also helped. The difficulties in learning and using them keep the added complexity away from the code itself. (Yeah, Unit Testing is an old example, I admit it.)

</comment><comment><USER6> Utter nonsense. More to the point, dangerous nonsense, because some people may read it and go through with it.

There's only one good reason to leave a job (other than retirement/health/personal reasons unconnected with the job itself) - <USER2> you have a better opportunity elsewhere. Whether that better opportunity is more responsibility, a bigger paycheck, a better work environment, new skills, whatever, it should be better than what you have now.

To leave a job just because you feel "unchallenged" - well, either you have a trust fund, or you are plain stupid.

<comment><USER16> I felt that was implied. I didn't see it as "Leave with no attention to other commitments;" rather, as "leave to someplace better that will offer you this."

Indeed, your taking his advice far too literal.

</comment></comment><comment><USER17> Instead of "If you aren't being challenged in your job – leave". I would say: find a way to challenge yourself. Take some initiative. It might be your job that's stopping you from reaching greater things, but I bet it's not your place of employment.

Talk to some experts. Come up with new ideas. Be disruptive. You've got the knowledge, the contacts, and the credibility to do so. Leaving now without trying that first seems like giving up to easily to me.

</comment><comment><USER18> All the criticism of the post is centered on how unconventional the advice is, and how impractical it would be for one to follow. Both criticisms are particularly evident in the missive that following the advice "would make for a bad resume". And yet, that is exactly what is being taken to task here.

The author is suggesting that you release the practical & conventional wisdom surrounding your job and how it routinizes both you and your life. The first requirement is that you throw out thinking about your resume. You reject staying somewhere you're either not happy or not growing just because it might look good on a piece of paper, or because you think you're actually going to get somewhere with it.

In another author's words:

You're not your job. You're not how much money you have in the bank. You're not the car you drive. You're not the contents of your wallet. You're not your f*ing khakis.

</comment><comment><USER19> According to this post, I reckon at least 95% of people fit the criteria of those that need to leave their job.

 _"The role of a manager should be to ensure that those that work for him/her eventually leave and go onto bigger and better things"_

I would honestly love to know the source of this quote.

I'll admit, the ideal manager is one who's primary focus is the employee's personal development but put yourself in the shoes of the manager; your focus is almost entirely on two specific things: Your own personal development and maximising your current staff's ability in order to be a more successful manager in the eyes of your superiors.

</comment><comment><USER20> "If where you work there is a business culture of trying to make competitors fail – leave."

That rules out the vast majority of companies with direct competitors.

<comment><USER21> At least it rules out a lot of (most?) Fortune 500 companies. It might not rule out my employer, but it would probably rule out quite a few business units within my employing company.

I'd say it absolutely rules out Microsoft. ;-)

</comment></comment><comment><USER22> so what i'm reading is the ideal job is getting paid not enough money to work a job where people don't like you, you don't know enough about the system, you fail a lot at the things you do, you're constantly under pressure, your business doesn't care if you quit, and neither you nor your company are successful.

</comment><comment><USER23> Sure, we all know that no job or entrepeneurial venture _ever_ involves being knowledgeable, bored, or feeling unmotivated or unchallenged. Nope. The minute you hit one of these minor obstacles you should throw up your hands and quit immediately. That's the recipe for a happy life..

"If you aren't failing enough – leave and go find somewhere where you fail before you succeed. When you find yourself succeeding too often – leave again."

I see - and where, exactly, are the people who will hire someone and then keep them around while they fail on a regular basis?

</comment><comment><USER24> The post is unreasonable, but most reasons to leave a job are good in that they teach you to remain dynamic and doing new, better, greater software (or whatever you do).

However, I found at least one exclusive set of points: -If you aren't being challenged in your job – leave. -If someone is standing in the way of your progress (either internally or externally) – leave.

Someone may be standing in your way - isn't that a challenge to beat him?

</comment><comment><USER25> A couple of years ago I would have given similar advice. However, since the recession started the job situation has utterly changed, and you can't just leave and expect to step into another job quickly - no matter how talented you are or how many letters you have after your name.

My advice now would only be to leave if you have a good alternative confirmed job offer or are starting a business.

</comment><comment><USER26> The article was written to provoke discussion. That being said, "There's a time to earn, and there's a time to learn." The author certainly values learning and experience over what is typically defined as stability. This points to his beliefs and experiences with growth.

<comment><USER26> Or perhaps he's buddhist. Lao Tzu wrote, "If you want to be given everything, give everything up."

</comment></comment><comment><USER27> Post makes a huge assumption, you __are __your job. That is your job is your life, your most important and proudest accomplishment. To the contrary, many people work to support what is there real passion(s). It's just a job.

</comment><comment><USER28> Was this written by a freelancer by any chance?

<comment><USER29> Or maybe written by an wealthy heir?

</comment></comment><comment><USER30> Leave a job when and only when you want to.

Leave or stay a job, cherish your time and make everyday as interesting and satisfying as possible.

</comment><comment><USER31> So, if I feel successful, content, well paid, respected I should leave my job? I don't think so!

</comment><comment><USER32> look at Parasoft's unit testing capabilities - it's very interesting:

www.parasoft.com/unittesting

</comment><comment><USER33> So suppose I work on a garbage dump searching for stuff that can be recycled. Because I could not find a proper job. Since I probably don't enjoy my job, I should leave - to do what?</comment>


Show HN: I Built a Home Server on the Cheap (Detailed Guide) - <AUTHOR> https://bagdeabhishek.github.io/homelab/ <comment><AUTHOR> Just thought about sharing a blog post I've written to document how and why I built up a home server. This can be thought of as a guide as well to get started on cheap.</comment>


Goodbye, bullet trains and windmills - <AUTHOR> http://www.salon.com/news/opinion/feature/2010/06/08/infrastructure_concrete_rail_lind/ <comment><USER2> I understand articles like this are meant to introduce ideas to a very wide swath of people, but I really dislike them. There are too many disparate points. It started with unemployment; wadded into Keynesian economics; took a shot at Wall Street; invoked FDR; and hinted that governments are required for scientific progress. That's way too much for one article.

If you want to say trains and windmills are not the best form of investment with regards to the environment and economic costs, talk about that. All the added political weight just makes the article divisive. Part of his policy prescriptions are predicated upon infrastructure spending, so you could say the "added weight" was required. I think it just makes the article weaker.

</comment><comment><USER3> These are all good points, but pretty shortsighted. Yes, convert from coal to natural gas. Yes, build cleaner nuclear. But we cant continue to build dams.. the good spots are gone and we need the few remaining wild rivers because they are part of our heritage.

What he dismisses is technological progress. Maybe, solar aren't cost effective now. but they are getting better by the year. The subsidies are worth it to get there. And he doenst even talk about conservation measures like more fuel efficient cars or painting all the roofs in America white.

He dismisses bullet trains too easily. Sure, cross continent maglevs dont make sense, but SF to LA is faster than airplanes + security theater. I shudder to think of the highway construction necessary to support 500 million people. Maybe telecommuting and self-driving cars are a better alternative.

<comment><USER4> In a round about way, I think he's dismissing thinking current technology is a panacea - as the (mostly idealistic) environmental movement would have us believe.

The real issue though of is what should we target the ratio of deployment versus R&D of of such tech. Whenever I hear a politician brag about how many solar panels they installed, it sounds like corporatism. How about an X-Prize / grants for alternate energy with REAL metrics.

Maglevs don't really make any sense compare to standard high-speed electric rail (BulletTrain, TGV, etc.). However, I will agree with you 100% that reducing consumption is rarely mentioned, and is probably the cheapest way of reducing economic and environmental costs.

However, it's more popular to fund wiz-bangery than to impose un-sexy fuel/water/etc. taxes.</comment></comment>


Presentation about DragonflyBSD's HammerFS [pdf] - <AUTHOR> http://leaf.dragonflybsd.org/~thomas/dillon_hammer/dillon_hammer_NYCBSDCon2008.pdf

<comment><USER2> Reminds me of baggy pants.</comment>


The Physics of Angry Birds Space - <AUTHOR> http://www.wired.com/wiredscience/2012/03/the-gravitational-force-in-angry-birds-space/

<comment><USER2> Two interesting things to point out:

First, Angry Birds has used Erin Catto's Box2d physics library. I don't know about Angry Birds Space, but I assume they still use the same physics engine. However, they might have modified the lib to facilitate non-uniform gravity. As far as I know, they haven't contributed the changes back. Not that they're obliged to (by the license) but it would still be polite after making millions using that library. Or at least give credit to Mr. Catto.

Second is the "frictional force" mentioned in this article. As a hobby I do physics simulation code, I've done several gravity simulations. In order to get a stable simulation you need a very nice numerical integration method (I've used one called Runge-Kutta-Nyström, but there are others that work, maybe better). Game physics engines typically have a different kind of numerical integrator that is supposed to give stable results when lots of objects are stacked and colliding. I think that the source of the frictional force in AB:S is, in fact, the numerical error introduced by the integration method.

Different numerical integration methods have different error characteristics, e.g. the RKN method I've used "leaks" energy over time, so orbits decay over time. But I've gotten simulations to run for hundreds of orbits before a change in the trajectory becomes noticeable.

<comment><USER3> They probably aren't doing anything special with gravity - they're just applying a central 1/r^2 force to anything that touches the sensor region (the atmosphere, in this case). One of the Box2d testbed demos has a similar example, it's very simple to do.

The frictional force is also pretty simple, likely just Box2d's linearDamping term, which very loosely models drag and exponentially slows down objects. Box2d uses symplectic Euler integration, which tends to be pretty good about conserving energy; it definitely wouldn't cause that much deflection from a stable orbit if the force was central.

</comment></comment><comment><USER4> Interesting point about gravity I came across in a book recently ( _The Beginning of Infinity_ by David Deutsch):

> most non-physicists consider it self-evident that when you hold your arm out > horizontally you can feel the force of gravity pulling it downwards. But you > cannot. The existence of a force of gravity is, astonishingly, denied by > Einstein's general theory of relativity. This says that the only force on > your arm in that situation is that which you yourself are exerting, upwards, > to keep it constantly accelerating away from the straightest possible path > in a curved region of spacetime.

I won't pretend to understand all of this (perhaps someone would like to explain it?) but it's interesting nonetheless.

<comment><USER5> This is hardly the place to discuss General Relativity but I can give a small explanation. Do you know the metaphor for gravity with a rubber sheet? Masses make dimples in the sheet and when particles pass, they get deflected. Similarly, when something moves past the Sun, it gets deflected and that's the reason we stay in orbit.

Of course you could say you're holding your arm still and there's no reason for it to veer of course and suddenly start moving. But it actually is in motion, everything moves through time! It's this movement that gets deflected into spatial directions. We human observers have to move through time, we can't stop to get the big picture and that's why objects in the vicinity of masses suddenly start accelerating.

...Maybe I should write a book.</comment></comment>


Ask HN: Advice for my YC application? - <AUTHOR> Hi! I am 20 y/o programmer from india applying to YC for S17 and looking for some advice on my application. Would you mind taking 10 mins out to read it give some feedback?<p>https://docs.google.com/document/d/1FCG5c-X9jH9jCFSTdxiqEjMmwPybyCcPiTBNNYJwres/edit?usp=sharing <comment><USER2> > People can pay to view other people's shortcomings.

Don't you think this will discourage potential users? What's my incentive to use this service, if you are basically going to sell my fears about myself for profit?

<comment><AUTHOR> Thanks for the feedback. That's the exact reason why i posted the it as askhn. I am apprehensive too, want to know what the community thinks.

</comment></comment><comment><USER3> I think if you can allow creating of anonymous personas, and also tackle the spam problem, you'll have gold. No one wants to put their name onto a platform where their shortcomings are tracked. But I would happily create an anonymous persona to get feedback that helps me make my life and behavior better. I think holds true for most people.

Hence the nut you've to track is allowing pseudonymous persona's but not allowing spam/riff-raff, and building a genuine community of helpers. Helping anonymous strangers is an inherently altruistic endeavour so you have to figure out the carrot and stick factors for both sides.

</comment><comment><USER4> "Linkedin+tinder prioritizing character"

This isn't super clear and left me confused.</comment>


Mary Queen of Scots documents found at Museum of Edinburgh - <AUTHOR> https://www.bbc.com/news/uk-scotland-edinburgh-east-fife-47495831 <comment><USER2> These are wonderful primary source documentation of the day-to-day mundanities of life, and I believe that's more important to history than solving the Big Mysteries of Great Men (and Women). Sadly, they're not in her handwriting, aside from her signature. But stuff like "salt production, the selling of meat and the building of a bulwark at Leith" tells us a lot about the details of 16th-century life in Scotland.</comment>


Persistant and unblockable browser cookies using last-modified HTTP header - <AUTHOR> http://nikcub.appspot.com/persistant-and-unblockable-cookies-using-http-headers <comment> mike-cardwell As long as caching exists, there will always be tricks like this. Here's another example: Encode a unique ID in an image and send that to the browser with a long cache time. Then on subsequent requests, use JavaScript canvas to read the image and decode the unique ID from it.

I've already completely disabled disk caching in Firefox by setting browser.cache.disk.enable to false. I'm seriously considering disabling the in memory cache too at browser.cache.memory.enable.

EDIT: In fact, I've just gone and disabled in memory caching. Will be interesting to see if this change is noticable in my normal usage.

<comment><USER2> Even the Canvas/JS is not necessary. Have your website load up a styles1.css file which is really generated by a script and has long expiry; that can then in turn @import a styles2.css embedding some unique ID in the imported URL (alternatively reference an image with the unique ID). As usual you would try to identify the user by existing cookies first, so this is a fallback.

The styles2.css has little or no caching enabled, so that it's requested reasonably often by the browser; it can then set a cookie or you can just correlate the information on the server side.

That doesn't require Javascript, just CSS (if requiring JS is OK, you could serve a some innocently named "helper_functions.js" that sets windows.uuid = "some unique value" and force it to be cached).

The site that started this: <http://samy.pl/evercookie/>

</comment></comment><comment><USER3> The plugin mentioned at the end won't work - not unless it's going to have a tedious whitelist.

Since many sites use "3rd party requests" like remotely hosted images, fonts, and even for example google based jquery, blocking them would most certainly break the page.

What I would like is a warning when the last-modified appears to be a malformed date or not a date at all. PHP's strtotime can convert almost anything to a date/time (if it really is a date). Can it be ported? Optionally when it doesn't appear to be a date within the past 30 days, never cache it.

Another solution for a pure privacy mode is to never send back last-modified, ever. It would hurt servers and page load times because things would never be cached and always served as "200" instead of "304" but for a pure privacy mode, may be necessary.

Last but not least, we could just dial down our cache time limit to say an hour max. It would still give some info to the trackers but not between browser sessions or the computer turned off. Since firefox doesn't have a time limit on the cache, using a memory-only cache is the only easy workaround for now.

<comment><USER4> Http defines the date format precisely (although there are 3 valid formats) and browsers already can parse it for other purposes, like cache expiry. <http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html> I imagine this bug will be fixed pretty quickly as the http replies being sent are out of spec.

</comment></comment><comment><USER5> Very interesting find, one of those that when you read the title you immediately realize its so obvious, just you never thought about it before!

One thing to note, the date could still be used to identify using any date, say 01/17/2157 identifies you. What could be done is to restrict the date to (present time - 3.months) <= last-modified <= present time.

That effectively reduces the number of people they can track to 7776000. Rounding off the seconds would reduce it to 129600.

</comment><comment><USER6> Ensuring that if-modified-since is a proper date might not help much there. The evil site could just encode the unique id info in the time (and/or date) portion of the tag. A possible workaround would be for the browser to randomly send time a few seconds in the past, so the cache still mostly works, but that the value can't be reliably used for anything else.

<comment><USER7> If we force If-Modified-Since to be in the last year and limit it to 1 minute resolution, that leaves 19 bits worth of uniqueness for the site to play with - probably not enough for tracking on a large affiliate network?

<comment><USER8> Can n image GETs (or similar) be used to produce 19*n bits of uniqueness, presuming that the affiliate network is willing to handle a factor of n more requests?

<comment><USER9> Oof, you're right. These are better than cookies because you can set them for specific URLs. Correlating requests wouldn't be too hard, just look for consecutive requests from the same IP with the same referrer.

</comment></comment></comment></comment><comment><USER10> I am surprised that it works like that. I would have expected the browser to just remember the last time they accessed a resource and send that time along.

<comment><USER11> That seems like a pretty good idea to me; would make the last-modified response header unnecessary. I'm guessing it's not done this way because of synchronization issues? (e.g., if someone has their computer's clock set to the year 2025, they can never refresh on servers that use the header)

</comment></comment><comment><USER12> That is a surprisingly clever and evil hack.

</comment><comment><USER13> >The privacy plugin that I am working on, Parley, would solve the cross-site tracking aspect of this bug, since it blocks all third party requests.

[https://addons.mozilla.org/en- US/firefox/addon/requestpolicy...](https://addons.mozilla.org/en- US/firefox/addon/requestpolicy/)

<comment><AUTHOR> should have mentioned that it is a Chrome extension

and the reason why I haven't released it is because I am experimenting with a number of features such as cookie rewriting, cache invalidation by rewriting requests, forcing SSL, etc.

</comment></comment><comment><USER14> As the maintainer of an open source proxy (Seeks), I'm playing with randomizing the last-modified header, on demand. The randomizing procedure is triggered by a regexp over the requested URL.

Does anyone here know if (and where) a useful list of websites that use such tracking methods has been compiled ?

</comment><comment><USER15> Just remove the Last-Modified header from all in-coming server responses? And remove the If-Modified-Since header from all browser requests? If these can be set to arbitrary strings without affecting browser performance, user experience etc why have these headers at all?

</comment><comment><USER16> I'm not a fan of virtualization for apps that are maintained and should be able to coexist under one kernel, but I may reconsider since browser and plugin vendors are still not offering a permanent Chinese wall between my activities on separate sites.

<comment> T-hawk Because the sites themselves don't work with a Chinese wall between sites. Yourfavoritesite.com is probably loading images from images.yourfavoritesite.com, or possibly akamai.net, and scripts from jquery.com. Making a browser able to distinguish between that and black-hat cross-site stuff is an extremely difficult task that we still haven't gotten quite right.

<comment> mike-cardwell I wish we had sandboxed tabs. Ie you create a sandboxed tab instead of a normal tab, it has its own cache, it's own cookie store etc. I could open my bank website in a separate sandboxed tab and not have to worry about sites in other tabs hitting it with CSRF attacks etc.

</comment></comment></comment><comment><USER17> As a UK based web developer, All these esoteric tracking methods makes me hate on the ICO's recent idiocy even more.</comment>